CVE-2023-33183: Error in calendar when booking an appointment reveals the full path of the website

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-30 · updated 2026-06-17
Weakness: CWE-285

Description

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3

Affected products

Nextcloud Calendar application: before 3.5.5; from 4.0.0 before 4.2.3 — fixed in 3.5.5, 4.2.3

How to fix

Upgrade to a fixed version: Nextcloud Calendar application 3.5.5, 4.2.3. Check the vendor advisory for mitigations.

References

https://github.com/nextcloud/calendar/pull/4938
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j
https://github.com/nextcloud/calendar/pull/4938
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j

Get alerted when CVE-2023-33183 or the next vulnerability affects your stack